ZachXBT Uncovers $3.1 Million Exploit in BSC Project ‘GANA Payment’

Summary:
Blockchain security researcher ZachXBT has revealed a severe exploit involving GANA Payment, a project on the BNB Smart Chain, leading to a loss of over $3.1 million. The attacker laundered substantial amounts through Tornado Cash, with part of the stolen funds remaining on the Ethereum blockchain. Following the incident, GANA's team has initiated an investigation and outlined a recovery plan.

Key Takeaways:

GANA Payment faced a major security breach, losing more than $3.1 million.
The hacker laundered funds using Tornado Cash and split assets between the BSC and Ethereum networks.
The security breach was due to unauthorized manipulation of the contract ownership.
GANA's official team is conducting a thorough investigation and has promised an upcoming recovery plan.
This incident occurred after a month where losses in the crypto sector were at their lowest.

ZachXBT Uncovers $3.1 Million Exploit in BSC Project ‘GANA Payment’

Major Exploit Shakes GANA Payment

Blockchain security expert ZachXBT has announced that the GANA Payment project, which runs on the BNB Smart Chain, has been exploited, resulting in thefts exceeding $3.1 million. The perpetrator managed to launder a large share of the stolen assets via Tornado Cash across both the BSC and Ethereum networks, leaving around $1 million inactive on the Ethereum blockchain.

ZachXBT detailed on his Telegram channel that the hacker gathered the stolen funds at address 0x2e8***5c38 and subsequently deposited 1,140 BNB—equating to about $1.04 million—into Tornado Cash on BSC. The attacker then linked the funds to Ethereum, transferring an additional 346.8 ETH valued at $1.05 million through the mixer. Currently, 346 ETH remains untouched at the address 0x7a503***b3cca.

Understanding the Security Breach

Contract Ownership Manipulation Exposed

Blockchain security firm HashDit quickly identified the source of the exploit after closely observing suspicious activities surrounding the contract.

Before the attack, there was a malicious alteration of GANA's contract ownership. This unauthorized transfer granted the hacker illicit control over the project’s staking mechanisms, enabling manipulation of reward rates. The attacker could invoke unstake functions, resulting in the accumulation of significantly more GANA tokens than intended. These excess tokens were then offloaded on the market for liquidity, with the proceeds funneled back through Tornado Cash.

In light of these developments, HashDit issued a critical alert warning users to refrain from trading GANA tokens until the project team issues official communications regarding the situation.

The incident adds to BSC's security concerns, although the last few months had seen relatively few substantial breaches. While BNB Chain reported a reduction in overall losses—from $161 million in 2023 to $47 million in 2024—individual attacks like this one continue to challenge the network's defenses despite ongoing security improvements.

Some notable previous incidents include a September phishing attack that drained $13.5 million from a Venus Protocol user and a $183,000 breach on the meme coin platform Four.Meme attributed to a sandwich attack around its Test token.

Steps Towards Recovery

GANA Team Initiates Investigation

In response to the incident, GANA’s official team promptly acknowledged the attack on their interaction contract, confirming unauthorized asset theft. They announced a partnership with an independent third-party security firm to perform an urgent investigation. This assessment aims to understand the attack vector, determine vulnerabilities, and gauge the overall impact.

The team committed to rolling out a comprehensive recovery strategy, including meticulous mapping of user asset addresses and their permissions. GANA expressed remorse for the disruption and assured stakeholders that detailed recovery plans and timelines would be shared shortly through official channels.

This exploit was particularly concerning as it arose just after the cryptocurrency industry reported its lowest monthly loss numbers of the year, with $18.18 million stolen across 15 reported incidents in October—an 85.7% drop from September's $127.06 million in losses. Even as security measures become more robust, experts caution that cyber threats are evolving in tandem.

Moreover, this GANA exploit follows an even larger breach earlier in the month affecting the Balancer Protocol, which suffered losses over $128 million due to sophisticated smart contract manipulations.

In conclusion, while some recovery efforts are underway, the GANA incident reflects ongoing challenges within the cryptocurrency landscape, emphasizing the need for continued vigilance and robust security measures.